[CI/CD] Dependabot GHA updates

[dmytroye]

📝 Description

Updates CI/CD dependencies (GitHub Actions + Python tooling requirements) and aligns MediaMTX container versions used in local/test docker-compose setups.

Changes:

• Bump bluenviron/mediamtx image tag from 1.16.1 to 1.16.3 in compose files used by PPL runner and perf tests.
• Update pinned GitHub Actions SHAs across security/scanning workflows (Zizmor, Trivy, CodeQL, Scorecard, artifact uploads, etc.).
• Refresh .github/resources/requirements.txt toolchain pins (e.g., pip, selenium, xmltodict, pylint, wheel).

✨ Type of Change

Select the type of change your PR introduces:

• 🐞 Bug fix – Non-breaking change which fixes an issue
• 🚀 New feature – Non-breaking change which adds functionality
• 🔨 Refactor – Non-breaking change which refactors the code base
• 💥 Breaking change – Changes that break existing functionality
• 📚 Documentation update
• 🔒 Security update
• 🧪 Tests
• 🚂 CI

🧪 Testing Scenarios

Describe how the changes were tested and how reviewers can test them too:

• ✅ Tested manually
• 🤖 Ran automated end-to-end tests

✅ Checklist

Before submitting the PR, ensure the following:

• 🔍 PR title is clear and descriptive
• 📝 For internal contributors: If applicable, include the JIRA ticket number (e.g., ITEP-123456) in the PR title. Do not include full URLs
• 💬 I have commented my code, especially in hard-to-understand areas
• 📄 I have made corresponding changes to the documentation
• ✅ I have added tests that prove my fix is effective or my feature works

[Copilot]

Pull request overview

Updates CI/CD dependencies (GitHub Actions + Python tooling requirements) and aligns MediaMTX container versions used in local/test docker-compose setups.

Changes:

• Bump bluenviron/mediamtx image tag from 1.16.1 to 1.16.3 in compose files used by PPL runner and perf tests.
• Update pinned GitHub Actions SHAs across security/scanning workflows (Zizmor, Trivy, CodeQL, Scorecard, artifact uploads, etc.).
• Refresh .github/resources/*requirements*.txt toolchain pins (e.g., pip, selenium, xmltodict, pylint, wheel).

Reviewed changes

Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tools/ppl_runner/docker-compose-ppl.yaml	Bumps MediaMTX image used by the PPL runner RTSP profile.
tests/perf_tests/compose/docker-compose-inference_performance.yml	Bumps MediaMTX image used by inference performance tests.
.github/workflows/zizmor.yml	Updates pinned Zizmor action SHA.
.github/workflows/trivy.yml	Updates pinned Trivy action SHA for filesystem scanning.
.github/workflows/tracker-service.yaml	Updates actions/upload-artifact pin for coverage artifacts (comment needs correction).
.github/workflows/tests-bat.yml	Updates actions/upload-artifact pin for BAT artifacts (minor comment formatting consistency).
.github/workflows/scorecard.yml	Updates CodeQL upload-sarif pin and artifact upload pin.
.github/workflows/gitleaks.yml	Updates artifact upload pin for gitleaks report.
.github/workflows/coverity.yml	Updates artifact upload pin for Coverity results.
.github/workflows/codeql.yml	Updates CodeQL init/analyze/autobuild pins and artifact upload pins.
.github/workflows/clamav.yml	Updates artifact upload pin for ClamAV report.
.github/resources/requirements.txt	Bumps CI Python tooling dependencies (pip/selenium/xmltodict/pylint).
.github/resources/coverity-requirements.txt	Bumps Coverity workflow Python tooling dependencies (pip/wheel).